New Zealand says Chinese ‘state-sponsored’ group hacked parliament

New Zealand has accused Chinese state-sponsored hackers of infiltrating parliament, joining the United States and United Kingdom in accusing Beijing of malicious cyberactivity.

New Zealand Foreign Minister Winston Peters said on Tuesday that the cyberattack was “unacceptable” and his country’s concerns had been conveyed directly to Beijing.

“Foreign interference of this nature is unacceptable, and we have urged China to refrain from such activity in future. New Zealand will continue to speak out – consistently and predictably – where we see concerning behaviours like this,” Peters said.

Peters, who last week met with Chinese Foreign Minister Wang Yi, said New Zealand and China shared a “significant and complex relationship”.

“We cooperate with China in some areas for mutual benefit,” he said. ”At the same time, we have also been consistent and clear that we will speak out on issues of concern.”

New Zealand’s Government Communications Security Bureau (GCSB) said earlier that its National Cyber Security Centre discovered that a state-backed hacking group known as “APT40” had compromised computers linked to the parliamentary network in 2021.

“The NCSC provided extensive support to the victim organisations to reduce the impact of the compromise and delivered advice to other organisations potentially at risk by association,” GCSB Director-General Andrew Clark said in a statement.

“Analysis of the tactics and techniques used by the actor enabled us to confidently link the actor to a People’s Republic of China (PRC) state-sponsored group known as APT40. This link has been reinforced by analysis from international partners of similar events in their own jurisdictions.”

A spokesperson for the Chinese Embassy in New Zealand said the allegations were “groundless and irresponsible.”

“We have never, nor will we in the future, interfere in the internal affairs of other countries, including New Zealand. Accusing China of foreign interference is completely barking up the wrong tree,” the spokesperson said.

New Zealand’s allegations come after the US and the UK on Monday announced sanctions against a Chinese company and two individuals accused of orchestrating a cyber-espionage operation targeting millions of people, including lawmakers, voters and prominent Beijing critics.

UK Deputy Prime Minister Oliver Dowden said cyberattacks in 2021 and 2022 had targeted the Electoral Commission and UK parliamentary accounts, including three MPs who are members of the Inter-Parliamentary Alliance on China.

New Zealand Defence Minister Judith Collins, who is responsible for the GCSB, said her country stood with its international partners in condemning China’s state-backed malicious cyberactivity.

“This collective response from the international community serves as a timely reminder to all organisations and individuals to have strong cybersecurity measures in place,” Collins said.